User Classifications

This topic explains the different ways users are classified on the Verify Privileged Identity Platform.

IT User and Business User are license types, not user classifications. On the Access > Entitlements page, the Verify Privileged Identity Platform calls these license types entitlements. For more information, see Platform Entitlements.

On the Verify Privileged Identity Platform, users are classified in multiple ways, including by whether they are human or non-human, by their identity source, by their membership type, and by their relationship to Verify Privilege Vault. These classifications, along with the user’s permissions granted through their roles and memberships, determine how the user is authenticated and what resources they can access.

For more information see

 

Human vs. Non-Human

  • Users: All human users

  • Service users: Non-human, non-interactive, programmatic access (API and service accounts). For more information, see Platform APIs.

On the Users page, you can change the users displayed by filtering by Users or Service Users.

Identity Source

Platform users are also identified by their Identity Source for authentication purposes:

  • Verify Privileged Identity Platform Directory: (Local) Created and managed directly in the Verify Privileged Identity Platform

  • Active Directory: Synced from on-premises Active Directory.

  • Federated Directory Service: Synced from external identity providers (e.g., SAML, OIDC).

  • Entra ID Directory: Synced from Entra ID

On the Users page, you can change the users displayed by filtering by Source.

Membership Type

Platform users are also identified by their Membership Type, sometimes known as their Identity Type. Membership Type classifies users according to their relationship to the organization, and specifies the policies and compliance standards that apply. Membership Types include the following:

  • Employee: Internal staff members of your organization.

  • Vendor: External users (contractors, consultants, third-party partners, etc.). The Vendor membership type exists so these users receive limited Vendor User capabilities and do not consume an IT User license. The Vendor membership type is separate from the Business User entitlement. A Vendor membership can apply to any identity source (Verify Privileged Identity Platform Directory, Active Directory, Federated Directory Service, etc.). If a vendor is instead left at the Employee membership type—the default for all users—they don't receive Vendor restrictions, and they consume the license for their entitlement (IT User or Business User). Vendors are managed with additional controls and workflows. See Contractor and Vendor Access.

On the Users page, you can change the users displayed by filtering by Membership Type.

Verify Privilege Vault Relationship

Platform users are also identified by their relationship with Verify Privilege Vault, which will be one of the following:

  • Hybrid: The user account existed in Verify Privilege Vault first, and the Platform user account is applied "on top" of that. These users have direct access to both the Verify Privileged Identity Platform and Verify Privilege Vault. They can log into Verify Privilege Vault directly if they need to. Passwords are not synchronized between the Platform and Verify Privilege Vault. Users must reset their passwords independently in Platform and Verify Privilege Vault.

  • Native: The user account existed on the Platform first, and the associated Verify Privilege Vault account was created afterward. These users can only log in through the platform, but not through Verify Privilege Vault. They cannot authenticate directly with Verify Privilege Vault.

  • None: The user account exists in Verify Privilege Vault only. It is not associated with any Platform account.

On a specific user page, you can view the user’s Verify Privilege Vault relationship under Secret Server Details.

See the following content on users: